[geeks] Need expert opinion

[velociraptor]

On Tue, 5 Oct 2004 13:51:44 -0400, geeks at litfire.com <geeks at litfire.com> wrote:
> > > What type of traffic are we talking about? Mail?
> >
> > Httpd visits.  On a particular URL we went from 24K hits to 4K hits.
> 
> Have you looked at the access log timestamps to see if the 4K hits you're
> still getting are distributed throughout the day, or if you're missing
> certain hours?

>From the WT view into the logs, yes, they are distributed similarly
as they were during the 24K days.  The drop happened within a
1-2 hour period on an individual day and has not recovered (I said
URL, but meant site--we run multiple sites out of the same set of
servers with multiple instances of Apache and separate logs).

The only other concurrent event that seems to go along with the
drop is a dramatic increase in the number of errors being gen-
erated.  This is directly related to a problem with the app the
proxy is serving (we verified that yesterday).  We have some
more leg work in this regard.

I have not gotten as far as grovelling the logs.  We have this
really odd logging set up--the Apache logs only get the load
balancer IPs, so there's this convoluted mess of merging that
goes on (I did not have a hand in this--I am just the poor 
bastard that has to deal with it now). 

Why they chose to merge rather than just doing some serious 
awk foo on the server load balancer logs (the URL is in there
already) to get them into a layout WebTrends understands is
beyond me.

Log grovelling is one of my next steps, but I have some other 
fires to fight that have higher priority (as per norm).

Thanks--
=Nadine=